#!/bin/bash

#------------------------------------------------------------------------------
#Filename:	74775-gid.sh
#Version:	1.1
#Date:		2013/07/16
#Author:	yuanhui.shi
#Email:		yuanhui.shi@cs2c.com.cn
#Summary:	02.01系统核心功能-05内核支持-03附加挂载选项-03gid
#Notes:		keyword gid 该用例里面请关注ls 和ls -l
#Copyright:	China Standard Software Co.,Ltd.
#History:
#		Version 1.0,2013/07/16
#		-The first one
#		Version 1.1,2013/09/05
#		-Modify the script to satisfy the shell standard
#------------------------------------------------------------------------------


PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH

source ../../lib/Echo.sh
source ./lib/Ssh.sh

function CleanData ()
{
  rm -rf /tmp/tmp.log1
  rm -rf /tmp/tmp.log2
  rm -rf /tmp/tmp.log3
  rm -rf /tmp/tmp.log4

  mount -o remount,hidepid=0,gid=0 /proc/

  #update --hhj
  userdel -r test
  userdel -r test1

  EchoInfo "74775-gid.sh执行完毕"
}

trap "CleanData" EXIT

#默认情况下hidepid=0，表示所有用户可看到/proc/PID/*文件。该脚本设置hidepid=2，普通用户可以查看到test自己的进程，不能查看/proc/下其他进程ID号，无权限查看其他进程/proc/PID/*下的文件。当设置gid时，该用户就可以查看其他进程的ID号，也可以查看其他进程/proc/PID/*下的文件。

EchoInfo "添加两个用户test和test1"
Adduser "test" "qwer1234"
Adduser "test1" "qwer1234"

EchoInfo "获取test用户的gid"
gid=`id test |awk '{print $2}'|sed 's/(.*//g'`

EchoInfo "设置挂载参数hidepid=2，并重新挂载"
mount -o remount,hidepid=2 /proc/

Ssh "test" "127.0.0.1" "qwer1234" "ls /proc &> /tmp/tmp.log1"
#test -z "`grep '不允许的操作' /tmp/tmp.log1`" 
#update --hhj
[ `wc -l /tmp/tmp.log1 | awk '{print $1}'` -gt 10 ]
EchoResult "可以查看到自己的进程" 

#test "`grep "1" /tmp/tmp.log1 |wc -l`" -lt 10 
#update --hhj
! grep -w "1" /tmp/tmp.log1 
EchoResult "不能查看到/proc/下其他进程的ID号"


Ssh "test" "127.0.0.1" "qwer1234" "LANG=C ls -l /proc/1 > /tmp/tmp.log2 2>&1"
#test -n "`grep "无法" /tmp/tmp.log2`" 
#update --hhj
grep "cannot access /proc/1: No such file or directory" /tmp/tmp.log2
EchoResult "不能查看其他进程下面的文件"


EchoInfo "设置挂载参数gid，并重新挂载。因为设置gid为test的gid，所以普通用户test可以查看/proc/PID/*下的文件"

mount -o remount,hidepid=2,$gid /proc/

Ssh "test" "127.0.0.1" "qwer1234" "ls /proc &> /tmp/tmp.log1"
#test -z "`grep '不允许的操作' /tmp/tmp.log1`" 
#update --hhj
[ `wc -l /tmp/tmp.log1 | awk '{print $1}'` -gt 10 ]
EchoResult "可以查看到自己的进程" 

#test "`grep "1" /tmp/tmp.log1 |wc -l`" -gt 10 
#update --hhj
grep -w "1" /tmp/tmp.log1
EchoResult "可以查看/proc/下其他进程ID号" 

Ssh "test" "127.0.0.1" "qwer1234" "ls -l  /proc/1 > /tmp/tmp.log2 2>&1"
#test -z "`grep "无法" /tmp/tmp.log2`" 
#update --hhj
[ `wc -l /tmp/tmp.log2 | awk '{print $1}'` -gt 10 ]
EchoResult "可以查看其他进程下面的文件" 

EchoInfo "因为设置hidepid和gid参数，test1用户只能查看自己的进程，无权查看其他进程的ID号"

Ssh "test1" "127.0.0.1" "qwer1234" "ls /proc &> /tmp/tmp.log3"
#test -z "`grep '不允许的操作' /tmp/tmp.log3`" 
#update --hhj
[ `wc -l /tmp/tmp.log3 | awk '{print $1}'` -gt 10 ]
EchoResult "可以查看到自己的进程" 

#test "`grep "1" /tmp/tmp.log3 |wc -l`" -lt 10 
#update --hhj
! grep -w "1" /tmp/tmp.log3
EchoResult "不能查看到/proc/下其他进程的ID号"

Ssh "test1" "127.0.0.1" "qwer1234" "LANG=C ls -l /proc/1 > /tmp/tmp.log4 2>&1"
#test -n "`grep "无法" /tmp/tmp.log4`" 
#update --hhj
grep "cannot access /proc/1: No such file or directory" /tmp/tmp.log4
EchoResult "不能查看其他进程下面的文件"
